Assessing It Department Performance And Staffing

What is the appropriate staffing size and skill set for your institution’s IT Department? This question is frequently asked by Executive Management and Board Members. While IT Management is generally aware of their department’s strengths and weaknesses, they often seek industry and peer statistics to support requests for changes in staffing numbers and additional training to ensure technical competency.

NETBankAudit has the benefit of partnering with over 800 organizations, largely community financial institutions, which has allowed us to observe the effectiveness of IT Departments with a wide range of staff sizes and skill sets. Our auditors and engineers are often asked for peer statistics and industry standards for IT Department staffing and we are always happy to share our experience. This article summarizes our observations.

Financial Institution Profile and IT Resources

The optimum IT Department staffing requirements are determined by the profile and related IT resource requirements for the respective financial institution. Critical factors include the number of locations, number of employees, and reliance on third party service providers for IT resources (e.g., core system, network services, and support functions).

Generally, asset size alone is not a useful measure for determining IT staffing requirements as such does not take into account the institution’s business strategy (e.g., retail focus with numerous office locations vs. commercial or wealth management focus with few locations). Ultimately, the IT Department staffing size and composition will depend on the number of employees, locations, devices and systems/applications that require local support and maintenance.

The institution’s decision to outsource certain IT resources also factors into the number of staff members and related skill sets that are required. Many institutions contract with third party service providers for core system hosting. A significant number also outsource network monitoring and maintenance, in addition to server hosting and management. However, it is noted that regardless of the number and nature of services that are outsourced, the financial institution remains responsible for their overall performance and security. Accordingly, while the functions may be hosted by third parties, responsibility for oversight and monitoring is still required.

Key Factors for IT Department Staffing

There are several factors that distinguish IT Department composition, including the number of staff members, their technical expertise, their experience with IT and with the respective institution, in addition to the organization itself (reporting structure and culture). These key factors and related considerations are discussed below.

Staffing Size

As noted above, the number of offices and geographic locations, in addition to the number of employees and endpoint devices that are supported, are key considerations in determining the appropriate number of IT Department staff members and related skill sets. Current industry statistics indicate that, for smaller companies (under 500 employees), a ratio of one IT staff member per 18 users is common, while larger companies (over 10,000) may see a ratio of one IT staff member per 40 users. Some research suggests a ratio of 70:1 for companies with a simple IT environment and 45:1 for more complex environments.

Technical Expertise

While the number of IT staff members might be assessed based on the number of employees and locations, the skill level and technical expertise is an important consideration. This also depends greatly on the institution’s dependence on third party service providers for core system and network services. Specific skill requirements may be warranted for in-house core systems (e.g., host system maintenance, program interface development, and related support). Such may be addressed by a combination of internal and external (e.g., contractor) resources. Technical support for network services is also dependent on the scope of internally supported and outsourced services (e.g., managed network environment, hosted servers, and related maintenance).

Experience

The level and depth of IT technical experience, in addition to experience with the respective institution’s environment also play a key role in determining staffing requirements. Experienced staff with several years of history with the institution provide additional value in terms of efficiency and expertise that is not easily replaced by new staff members, regardless of their education and prior job history. Accordingly, provisions for backup/cross-training and written procedures are important considerations to ensure knowledge transfer.

Organizational Structure

Every institution has a unique organizational structure which greatly influences its target IT Department size and composition. The institution’s organizational structure involves the oversight roles and reporting lines that are in place for all business departments, including Information Technology. However, this structure can vary significantly from one institution to another. Specifically, the roles of the Chief Technology Officer, Chief Information Officer, Chief Operations Officer, and Information Security Officer and their related oversight duties varies for each organization. In some institutions, these roles may be absent or combined. The respective departments and/or functional areas that report to these roles (e.g., Network Services, Deposit Operations, Loan Operations, Electronic/Digital Services) also varies and affects the number of resources required to support these functions. In addition, responsibility for additional IT related programs (e.g., Vendor Management, Project Management, and Business Continuity Management) significantly affects the number of resources that are required to address these areas.

Culture

The culture of each institution is unique and reflects its executive management’s history and strategy. Such has a significant impact on IT Department staffing as the “tone from the top” can serve as a strong motivator for productivity and work ethic. It can also adversely affect performance when employees do not feel that they are recognized and valued. Even in very small organizations with limited opportunities for promotions and management positions, employees can be motivated and incented by challenging work assignments, training opportunities, and recognition.

Critical Factors Beyond Staffing Numbers for IT Teams

Assessing IT Department Staffing Adequacy

While there are no reliable statistics for benchmarking IT Department staffing in terms of numbers and positions, management can assess the effectiveness of their IT Department by monitoring certain performance indicators as discussed below.

Performance and Evaluation Assessments

The performance of the IT Department can be evaluated based on activities that are performed and their effectiveness. Problems, exceptions, and other issues may be identified by internal and external audits, in addition to regulatory examinations. Increases in the number and significance of IT department related exceptions that are identified in audit and examination reports can indicate staffing and resource concerns.

Service/Help Desk Activity

The Help/Service Desk System can serve as a valuable resource for monitoring IT Department performance. Generally, most IT Service Desk/Ticketing Systems can provide reports summarizing activity detailing ticket status by category, assignment, and duration. This information can be leveraged to determine the issues that are requiring the most time by IT staff and identify opportunities to provide solutions to common problems (e.g., password resets). Additionally, trends in ticket aging (resolution time) can be helpful to identify the potential need for additional support resources.

General Observations

Depending on the expertise of IT Staff, size and location(s) of the IT Department, and provisions for oversight and administration, general observations can help to identify potential problems and concerns. Specifically, regardless of whether the IT Staff is located onsite at a central location, assigned to designated regional locations, or working from remote locations, provisions for regular team meetings, and real time communications are warranted. In addition, regular feedback between IT management and staff members is essential to ensure that procedures and priorities are understood and met.

Recommendations for Ensuring Continued IT Department Staffing Adequacy

The institution’s Board of Directors, IT Steering Committee, and IT Department Management are responsible for ensuring that appropriate internal and external resources are in place to support the institution’s IT and Operational functions. To ensure that this objective is met, the following recommendations are outlined.

Succession Planning

All financial institutions should have an IT Department and Information Security Succession Plan that addresses short and long term plans in the event of an unexpected loss of key staff members. While the plan should focus on IT and Information Security Leadership (e.g., CIO, COO, ISO), it should also address critical IT Department positions (e.g., Network Administrator).

Backup/Cross Training

To support the institution’s IT Department succession plans, cross training within the IT Department is an important consideration. Job sharing and backup training activities should be considered to ensure that existing employees can stand in for one another in the event of an unexpected absence.

Ongoing Training Opportunities and Motivational Programs

The retention of existing IT Department staff members is an important consideration, particularly for institutions that are smaller and have fewer opportunities for promotions to higher level positions. It is critical to ensure that existing staff members feel that they are valued and that they have opportunities for individual growth and development regardless of whether this involves a job title. To ensure that these employees feel valued and remain dedicated to the institution’s goals and objectives, management should consider offering educational opportunities, challenging project assignments, and other means of recognition to recognize these valued employees.

Summary and Conclusion

IT Department staffing requirements are unique for each financial institution and depend on their respective size, complexity, business strategy, and outsourcing strategy. There are no industry statistics or benchmarks for determining the adequacy of an institution’s IT department in terms of numbers and job titles/positions. However, there are a number of measures that a financial institution can leverage to determine whether its IT Department is appropriately staffed. Such include the results of audit and examination reports, in addition to Help Desk/Service Desk tickets and related statistics for problem/event categories and ticket aging (resolution time). Staff morale can also be measured by turnover and attendance measures.

 
class SampleComponent extends React.Component { 
  // using the experimental public class field syntax below. We can also attach  
  // the contextType to the current class 
  static contextType = ColorContext; 
  render() { 
    return <Button color={this.color} /> 
  } 
}